US10880400B2

Movatterモバイル変換

Info

Publication number: US10880400B2
Application number: US15/967,173
Authority: US
Inventors: Rajkumar Jalan; Rishi Sampat
Original assignee: A10 Networks Inc
Current assignee: A10 Networks Inc
Priority date: 2014-06-03
Filing date: 2018-04-30
Publication date: 2020-12-29
Anticipated expiration: 2034-06-03
Also published as: US9986061B2; US20180248975A1; US20150350379A1

Abstract

Exemplary embodiments for configuring a network device using user-defined scripts are disclosed. The systems and methods provide for a servicing node to receive a request for a network session between a client device and a server, receive a user defined class and a user defined object configuration from a node controller, and use the information to instruct an object virtual machine to generate at least one user defined object. The servicing node can then apply the at least one user defined object to a data packet of the network session, where the user defined object allows a user to configure the network device with user-defined instruction scripts.

Description

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a continuation of and claims the priority benefit of U.S. patent application Ser. No. 14/295,265 filed on Jun. 3, 2014, entitled “PROGRAMMING A DATA NETWORK DEVICE USING USER DEFINED SCRIPTS,” the disclosure of which is incorporated herein by reference.

BACKGROUND OF THE INVENTIONField of the Invention

The present invention relates generally to data networks, and more particularly, to a data network device that is programmed using user defined scripts.

Description of the Related Art

In a typical network deployment scenario, a company, such as a service provider or a corporation, constructs a data network by purchasing or leasing one or more network devices, connecting the devices with each other and to servers and gateways, and configuring the devices to reflect the network design. The data network is controlled and operated by the company. The company may use the data network to serve its clients or internal business divisions. For example, a web hosting service provider hosts websites for its clients and allows the clients' data traffic to be processed by the data network. Often times, the company also provides servers such as web servers or video servers to serve the clients.

Though it is common for a service provider to allow the clients to download and to run client software on the provided servers, it is not possible for the clients to download client software or instructions onto the network devices within the data network. This limitation presents issues to the service provider as well as the clients. As there are many clients and each client has different needs, it is impossible for the service provider to offer a one-size-fits-all or a gold-silver-bronze type of network service policy to accommodate many client needs in the data network. Clients, on the other hand, want to operate their own software, policies, and configuration and control of network resources that they lease from the service provider. All in all, both parties have a common desire to open up the data network so that a client can download client software directly to the network devices and so that the service provider can offer a better business experience to satisfy clients' needs.

It should be apparent from the foregoing that there is a need to provide a method to program a network device with user defined instruction scripts.

SUMMARY

This summary is provided to introduce a selection of concepts in a simplified form that are further described in the Detailed Description below. This summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used as an aid in determining the scope of the claimed subject matter.

The present disclosure is related to approaches for a user to configure a network device with user-defined instruction scripts. An exemplary method for configuring a network device comprises receiving a request for a network session between a client device and a server. The method may further include receiving a user defined class and a user defined object configuration at a servicing node. The user defined class and user defined object configuration may be defined by a user of the network device and used by the servicing node to instruct an object virtual machine to generate at least one user defined object. The method may further include applying the at least one user defined object to a data packet of the network session. The user defined object allows the user to configure the network device with the user-defined instruction scripts.

A system for configuring a network device with user-defined scripts is also disclosed. The system may include a servicing node comprising at least one user defined object and an object virtual machine that executes instructions enabled by the at least one user defined object while the servicing node processes a network session between a client device and a server. The system may also include at least one node controller that sends a user defined class and a user defined object configuration to the servicing node. The user defined class and user defined object configuration may be defined by a user of the network device and used by the servicing node to instruct an object virtual machine to generate the at least one user defined object.

Additional objects, advantages, and features will be set forth in part in the detailed description section of this disclosure, which follows, and in part will become apparent to those skilled in the art upon examination of this specification and the accompanying drawings or may be learned by production or operation of the example embodiments. The objects and advantages of the concepts may be realized and attained by means of the methodologies, instrumentalities, and combinations particularly pointed out in the appended claims.

BRIEF DESCRIPTION OF THE DRAWINGS

Embodiments are illustrated by way of example and not by limitation in the figures of the accompanying drawings, in which like references indicate similar elements.

FIG. 1 illustrates an exemplary embodiment of a servicing node servicing a session based on user defined objects.

FIG. 2 illustrates an exemplary embodiment of a network node.

FIG. 3 illustrates an exemplary embodiment of programming a servicing node with user defined class.

FIG. 4 illustrates an exemplary embodiment of configuring user defined objects.

FIG. 5 illustrates an exemplary embodiment of processing a data packet of a session using user defined objects.

FIG. 6 illustrates an exemplary embodiment of generating accounting data.

FIG. 7 illustrates an exemplary embodiment of deploying network services using user defined objects

FIG. 8 illustrates another exemplary embodiment of deploying network services using user defined objects.

DETAILED DESCRIPTION

The following detailed description includes references to the accompanying drawings, which form a part of the detailed description. The drawings show illustrations in accordance with example embodiments. These example embodiments, which are also referred to herein as “examples,” are described in enough detail to enable those skilled in the art to practice the present subject matter. The embodiments can be combined, other embodiments can be utilized, or structural, logical, and electrical changes can be made without departing from the scope of what is claimed. The following detailed description is therefore not to be taken in a limiting sense, and the scope is defined by the appended claims and their equivalents.

FIG. 1 illustrates an exemplary embodiment of a servicing node processing a service session105 (also referred to herein as session105) between aclient110 and aserver115. In one embodiment,client110 conducts asession105 withserver115 overdata network120. Data packets ofsession105 are sent throughdata network120 toservicing node125.Servicing node125 may modifysession105 data packets and forward the data packets toserver115.

In some embodiments,client110 is a computing device connected todata network120 using a network module of the client. The client device can be a personal computer, a laptop computer, a tablet, a smartphone, a mobile phone, an Internet phone, a netbook, a home gateway, a broadband gateway, a network appliance, a set-top box, a media server, a personal media player, a personal digital assistant, an access gateway, a networking switch, a server computer, a network storage computer, or any computing device comprising a network module and a processor module.

In various embodiments,server115 is a server computer connected todata network120 using a network module of the server computer.Server115 servesservice session105 requested byclient110.Service session105 may be an application service session and include, but is not limited to, a HTTP session, a file transfer session, a FTP session, a voice over IP session, a SIP session, a video or audio streaming session, an e-commerce session, an enterprise application session, an email session, an online gaming session, a teleconference session, or a Web-based communication session.Data network120 includes an Ethernet network, an ATM network, a cellular network, a wireless network, a Frame Relay network, an optical network, an IP network, or any data communication network utilizing other physical layer, link layer capability or network layer to carry data packets.

In some embodiments,servicing node125 includes anetwork application130 and appliesnetwork application130 tosession105 data packets.Network application130 includes, but is not limited to, a network proxy application such as TCP proxy, HTTP proxy, SIP proxy, a content delivery network application, a server load balancing application, a firewall, a remote access application, an application delivery application, a network traffic management and control application, a legal interception, a network optimization, an email scanning application, or an access control application.

FIG. 2 illustrates an exemplary embodiment of anetwork node205 which can be a servicing node or a node controller.Network node205 includes, but is not limited to, a processor module210, anetwork module215, and acomputer storage module220. Processor module210 includes one or more processors which may be a micro-processor, an Intel processor, an AMD processor, a MIPS processor, an ARM-based processor, or a RISC processor. In some embodiments, processor module210 includes one or more processor cores embedded in a processor. Additionally, processor module210 may include one or more embedded processors, or embedded processing elements in a Field Programmable Gate Array (FPGA), an Application Specific Integrated Circuit (ASIC), or Digital Signal Processor (DSP). In various embodiments,network module215 includes a network interface such as Ethernet, optical network interface, a wireless network interface, T1/T3 interface, or a WAN or LAN interface. Furthermore,network module215 includes a network processor.Computer storage module220 includes RAM, DRAM, SRAM, SDRAM, or memory utilized by processor module210 ornetwork module215.Computer storage module220 stores data utilized by processor module210 and comprises a hard disk drive, a solid-state drive, an external disk, a DVD, a CD, or a readable external disk. Additionally,computer storage module220 stores one or more computer programming instructions, which when executed by processor module210 ornetwork module215, implement one or more of the functionalities of the present invention.Network node205 also may include an input/output (I/O)module225, which comprises a keyboard, a keypad, a mouse, a gesture-based input sensor, a microphone, a physical or sensory input peripheral, a display, a speaker, or a physical or sensual output peripheral.

Referring again toFIG. 1, in various embodiments, servicingnode125 includes a user definedobject135 and an objectvirtual machine140. User definedobject135 includes one or more parameters to enable one or more instructions to be executed by objectvirtual machine140.Servicing node125 may invoke objectvirtual machine140 to execute the instructions enabled by user definedobject135 while servicingnode125

processes session

105. In other embodiments, servicingnode125 may apply user definedobject135 in conjunction withnetwork application130 to processsession105.

In some embodiments, servicingnode125 creates user definedobject135 from a user defined class145 and a user defined object configuration150. User defined class145 includes an instruction script or one or more instructions, a template for one or more instructions, or a description that can be used to create user definedobject135. User defined object configuration150 includes one or more configurations, one or more commands, one or more pieces of data, or one or more attributes for creating user definedobject135.Node controller155

programs servicing node

125 with user defined class145 script or by sending user defined class145 to servicingnode125. Alternatively,node controller155 or anothernode controller160 sends to servicingnode125 user defined object configuration150. While two node controllers are depicted in exemplaryFIG. 1, any number of node controllers may be connected to a servicing node.

In various embodiments, servicingnode125 may create and apply user definedobject135 after receiving user defined object configuration150 and user defined class145, prior toprocessing session105, or when processingsession105 is in progress.

FIG. 3 illustrates an exemplary embodiment for servicingnode125 to receive a plurality of user defined classes such as user definedclass305 and user definedclass310.Servicing node125 may receive the plurality of user defined classes fromnode controller155 or from a plurality of node controllers such asnode controller155 andnode controller160.

In some embodiments, user definedclass305 and user definedclass310 are not related. In other embodiments, user definedclass305 is related to user definedclass310. Table 1a and Table 1b illustrate exemplary embodiments of user definedclass305 and user definedclass310.

TABLE 1a

// User Defined Class 305

name = cm-se-name,	// Name of User Defined Class
occurrences =	// allow creation of multiple user defined objects
multiple,
license = se-isp,	// require license named “se-isp”

config-fields:

config = <start>,

// created object has a name identity

se-name = string <mvm; help SE name; range 1-14>,

// object has an IP address attribute

ip = ipv4-cidr <mb; dup-ip-check; help SE IP address range; >,

// Security policy

ddos-checks = flag <mk; help Enable ddos checks on SE>,

// Service policy, such as bandwidth (bw), capacity,

allowed network appl

bw = number <mb; allowed 200-2000; help Mbps;>,

conn-limit = number<mb; allowed 1-5000; help No. of connections>,

// selectable list of network applications

permit-apps = dummy <mk; help Permit application list>,

http = flag <ok; condition permit-apps; link-next-fwd ftp>,

ftp = flag <ok; condition permit-apps; link-next-fwd https>,

https = flag <ok; condition permit-apps; link-next-rev http>,

// accounting policy

enable-stats-collection = flag <mk;>,

config=<end>;

TABLE 1b

// User DefinedClass 310

name=cm-se-region

help=Create/delete a region object,

occurrences=multiple,

license=se-isp,

config-fields:

config=<start>,

se-region=string<mvm; help SE region; range 1-6>,

// User DefinedClass 310 uses User DefinedClass 305

“se-name”

se-name=string <mb; help SE name; range 1-14; max-elements 8;

obj-association

bw = number <mb; allowed 1000-500; help Mbps;>,

cm-se-name>,

config=<end>;

In Table 1a, user definedclass305 is named “cm-se-name”. The attribute occurrences being “multiple” allows servicingnode125 to create multiple user defined objects based on user definedclass305. The attribute license “se-isp” indicates user definedclass305 requires a license “se-isp” in order to create an associated user defined object. The attribute config-fields includes a list of configurable attributes which are to be included in a user defined object configuration. The config attribute se-name assigns a name to a created user defined object. The config attribute ip assigns an IP address or IP address range to a created user defined object. Typically, different created user defined objects of user definedclass305 are configured with different IP addresses. The ip attribute allows objectvirtual machine140 to determine if a user defined object is applicable to a session data packet. The config attributes may include other attributes such as layer 2 information, TCP/UDP port number, a pattern, a cookie, a layer 7 identifier, or any attribute that can be used to identify a data packet or a session.

The config attributes may include one or more attributes related to a security policy such as ddos-checks (applying Denial of Service (DOS) and Distributed Denial of Services (DDOS) detection). The config attributes include one or more attributes related to service policy such as bw (bandwidth capacity), conn-limit (capacity of active connections), and others. The config attributes may include permission to use one or more network applications available within servicingnode125, such as http, ftp, and https. The config attributes may further include one or more attributes related to data collection or accounting record processing or policy, such as enable-stats-collection (enabling the collection of various statistics).

Table 1b illustrates an embodiment of user definedclass310. In this exemplary embodiment, user definedclass310 refers to user definedclass305. The name attribute gives user defined class310 a name of “cm-se-region”. The help attribute indicates a network administrator may get help in order to generate a user defined object configuration using cm-se-region. The occurrences attribute “multiple” indicates multiple user defined objects using cm-se-region can be created. In other embodiments, having occurrences attribute “single” is to indicate at most one user defined object can be created based on the user defined class. The license attribute indicates a license named “se-isp” is required. In the exemplary embodiment of Table 1b, cm-se-region uses the same license as cm-se-name. In other embodiments, cm-se-region has a different license attribute than cm-se-name.

The config attributes of cm-se-region include se-region attribute assigning a name to a user defined object using cm-se-region. The configurable se-name attribute includes a list of user defined objects with names based on se-name. Recall Table 1a where se-name is a configurable name for a user defined object of cm-se-name. The configurable se-name attribute of cm-se-region, therefore, includes a list of user defined objects of cm-se-name.

Referring toFIG. 4, servicingnode125 receives user definedobject configuration405 fromnode controller160. Table 2 illustrates an exemplary embodiment of user definedobject configuration405 based on Table 1a and Table 1b.

TABLE 2

// User DefinedObject Configuration 405

cm-se-name se-name=Seattle ip=1.1.1.0/24 bw=200Mbps

conn-limit=500 permit-apps http ftp enable-stats-collection

cm-se-name se-name=”Bay Area” ip=1.1.3.0/23 bw=500Mbps ddos-

check conn-limit=2000 permit-apps http ftp https enable-stats-collection

cm-se-name se-name=”Los Angeles” ip=1.1.5.0/23 bw=1000Mbps

conn-limit=2500 permit-apps http ftp https enable-stats-collection

cm-se-region se-region=”West Coast” se-name= Seattle

se-name=“Bay Area” se-name=”Los Angles” bw=2500Mbps

In Table 2, three cm-se-name objects are configured. The first one is named Seattle with an IP address 1.1.1.0/24, a bandwidth capacity of 200 Mbps, a connection capacity of 500, a list of permitted network applications “http, ftp”, and with statistics data collection enabled.

The second cm-se-name object is named “Bay Area” with a configured IP address 1.1.3.0/23, a bandwidth capacity of 500 Mbps, a connection capacity of 2000, a list of permitted network applications “http, ftp, https”, and with statistics data collection enabled. Se-name object “Bay Area” also has security policy DDOS enabled.

The third cm-se-name object is named “Los Angeles” with a configured IP address 1.1.5.0/23, a bandwidth capacity of 1000 Mbps, a connection capacity of 2500, a list of permitted network applications “http, ftp, https” and with statistics data collection enabled.

User definedobject configuration405 includes one configured cm-se-region object, named “West Coast” and a bandwidth capacity of 2500 Mbps. The cm-se-region object includes the se-name objects “Bay Area”, Seattle, and “Los Angeles”. In this embodiment, the bandwidth capacity of 2500 Mbps is applied as the capacity for the combined bandwidth capacities of se-name objects “Bay Area”, Seattle and “Los Angeles”.

Upon receiving user definedobject configuration405 and user defined

classes

305 and310, servicingnode125 instructs objectvirtual machine140 to generate various user defined objects according to user definedobject configuration405, such as user defined

objects

410 and415. In some embodiments, objectvirtual machine140 determines that a user defined class requires a license. Objectvirtual machine140 communicates with anetworked license manager420, which can be a network computer or a software module in a network server or in a node controller. Once objectvirtual machine140 determines that servicingnode125 is licensed to use the user defined class, objectvirtual machine140 creates the user defined object, such as cm-se-name object “Bay Area”. In one embodiment, objectvirtual machine140 verifies the necessary licenses to use user defined

classes

305 and310, objectvirtual machine140 creates cm-se-name objects “Bay Area”, Seattle and “Los Angeles”, and cm-se-region object “West Coast”.

FIG. 5 illustrates an exemplary embodiment of processing adata packet505 ofsession105.Data packet505 may be sent byclient110 toserver115 or fromserver115 toclient110. In various embodiments,client110 sendsdata packet505 toserver115, andservicing node125 receivesdata packet505. Then, servicingnode125 sendsdata packet505 to objectvirtual machine140 for processing, and objectvirtual machine140

matches data packet

505 with user defined object535. Using an embodiment where user defined object535 is an cm-se-name object named “Bay Area”, objectvirtual machine140 matches the cm-se-name IP address attribute with an IP address ofdata packet505 such as a destination IP address or a source IP address. If objectvirtual machine140 determines there is a match, objectvirtual machine140 applies cm-se-name object “Bay Area” todata packet505. In some embodiments, object “Bay Area” enablesinstructions510 based on configured attributes of object “Bay Area”, which include ddos-check, enable-stats-collection, bandwidth capacity, connection capacity, and a list of permissible network applications. Objectvirtual machine140 appliesinstructions510 todata packet505. In various embodiments, objectvirtual machine140

checks data packet

505 for DDOS detection and collects data statistics such as packet count, data count, and/or connection count. If a DDOS is detected, objectvirtual machine140 may apply security policy handling todata packet505 orsession105. In other embodiments, objectvirtual machine140

checks data packet

505 for bandwidth capacity for object “Bay Area”. If bandwidth capacity for object “Bay Area” is not exceeded,data packet505 is allowed to be processed further. However, if the bandwidth capacity for object “Bay Area” is exceeded, objectvirtual machine140 may delayprocessing data packet505 until bandwidth capacity is no longer exceeded or objectvirtual machine140 may discarddata packet505.

In some embodiments, objectvirtual machine140

matches data packet

505 against the list of permissible network applications in object “Bay Area”. Objectvirtual machine140 retrieves layer 7 information fromdata packet505, such as a TCP/UDP port number, content in thedata packet505 payload, or information based on a prior data packet ofsession105, to match the list of network applications. Ifdata packet505 represents a HTTP data packet and HTTP is in the list of permissible network applications, objectvirtual machine140 allows continuing processing ofdata packet505. If, for example,data packet505 represents a SIP data packet and SIP is not in the list of permissible network applications, objectvirtual machine140 may discarddata packet505 or record an alert event for servicingnode125.

In various embodiments, objectvirtual machine140 determines user defined object515, for example, being cm-se-region object “West Coast”, is to be applied. Objectvirtual machine140 may determine to apply user defined object515 based on the association between cm-se-region object “West Coast” and se-name object “Bay Area” or based on a match betweendata packet505 and user defined object515. Objectvirtual machine140 appliesinstructions525 enabled by the configurable attributes of cm-se-region object “West Coast,” which include bandwidth capacity and statistics collection. Objectvirtual machine140 processesdata packet505 for bandwidth capacity and statistics collection according to the corresponding object “West Coast” configured values.

In some embodiments, user defined object535 is associated with one ormore object variables520, such as one or more counters for the statistics collection, bandwidth capacity, number of active connections, and DDOS detection variables. Objectvirtual machine140 updates values ofobject variables520 upon processingdata packet505. Objectvirtual machine140 may updateobject variables520 from time to time or based on administrator's command. In a similar embodiment, objectvirtual machine140 updates objectvariables530 associated to user defined object515.

Objectvirtual machine140 further sendsdata packet505 tonetwork application130 for processing. During processing ofdata packet505,network application130 may invoke objectvirtual machine140 for additional processing. Using cm-se-name object “Bay Area” for illustration,network application130 determines ifdata packet505 is a connection request.Network application130 invokes objectvirtual machine140 to process a connection request, and objectvirtual machine140 determines that object “Bay Area” is applicable and checks if the connection capacity attribute of object “Bay Area” is exceeded. If the connection capacity attribute of object “Bay Area” is not exceeded, objectvirtual machine140 instructsnetwork application130 to continue processingdata packet505. If the connection capacity attribute of object “Bay Area” is exceeded, objectvirtual machine140 may instructnetwork application130 to reject the connection request or to delayprocessing data packet505 until the connection capacity attribute is no longer exceeded. In some embodiments, objectvirtual machine140 updates objectvariables520 of object “Bay Area”. In another embodiment, objectvirtual machine140 determines if user defined object515 or object “West Coast” is also applicable. Objectvirtual machine140 applies enabledinstructions525 of object “West Coast” to the connection request ofdata packet505, and updates objectvariables530 of object “West Object.”

In some embodiments, ifdata packet505 includes a session disconnect indication,network application130 invokes objectvirtual machine140 to process the session disconnect indication ofdata packet505.

If user definedobject410 or user defined object515 includes a layer 7 security policy or service policy configured attribute,network application130 invokes objectvirtual machine140 to apply the appropriate policy.

Ifnetwork application130 modifiesdata packet505, such as applying a network address translation (NAT), modifying a cookie, replacing some content indata packet505 payload, inserting data intodata packet505, or other modifications known in the art,network application130 may invoke objectvirtual machine140 to process the modified data packet.

After the processing ofdata packet505 bynetwork application130 and objectvirtual machine140, servicingnode125 sends a resulting data packet toclient110 orserver115.

InFIG. 6, objectvirtual machine140 providesobject variables520 of user definedobject410 to anode controller155.Object variables520 may includeaccounting data605 and/orstatistics data610.Accounting data605 may include number of completed connections, number of security alerts based on security policy attributes of user definedobject410, amount of traffic over a period of time, one or more client device identities, one or more user identities of client device, or other useful accounting data.Statistics data610 may include number of active connections, traffic statistics such as byte count, packet counts, or other statistics data. In some embodiments,node controller155 receivesaccounting data605 andstatistics data610 of user defined object620.Node controller155 generates areport615 based on the received data.Report615 may include billing report, security report, service level agreement report, network security report, network monitoring report, network capacity or resource utilization report, user report associated to user defined object620, or report about a service provider, a regional service provider, a business entity associated to user defined object620, or a client. In various embodiments,node controller155 generatesreport615 based on additional data of other user defined objects obtained from servicingnode125 or other servicing nodes.

In some embodiments,node controller155

requests servicing node

125 to provide the data associated to user defined object620 and/or other user defined objects created by objectvirtual machine140.Node controller155 may request from time to time, periodically, or based on a schedule, ornode controller155 may send a request per administrator command.

Alternatively, in various embodiments, servicingnode125 sends the data automatically tonode controller155 from time to time, periodically, or based on a schedule.Servicing node125 may send the data or portion of the data based on an event, an security alert, or an administrator command, or servicingnode125 may send the data when user definedobject410 is removed from objectvirtual machine140.

FIG. 7 andFIG. 8 illustrate exemplary embodiments of using servicing nodes with user defined classes and objects. In the exemplary embodiment ofFIG. 7,node controller160 offers cloud services, and sends user defined

classes

703,704, and705 to servicingnode125. User definedclass704 is designed for cloud services offered to an area or a city, and it includes, but is not limited to, configurable attributes specifying security policies, service policies, IP address space, data collection policies, resource and capacity policies, and supported network applications. User definedclass705 is designed to offer aggregated cloud services over a region or a collection of area services. User definedclass705 may include aggregated IP address space, service policies, application policies, and capacities. User definedclass703 is designed for an aggregated cloud service covering a large geographic area.

In some embodiments,node controller160 sends a user definedobject configuration710 to objectvirtual machine140 to create a plurality of user defined objects based on user definedclass704. These created user defined objects for user definedclass704 are configured for various cities and area districts, each of which is configured with different attributes of security policies and other attributes. In other embodiments, the user definedobject configuration710 configures a plurality of objects based on user definedclass705. These created objects based on user definedclass705 are configured for regions, each of which covers a plurality of cities and area districts corresponding to the objects based on user definedclass704.

In various embodiments, user definedobject configuration710 includes a configuration for a user defined object based on user definedclass703. The created object is configured for acustomer715 ofnode controller160. The customer can be a business, a small cloud service provider, a company, an organization, or a private cloud. The user defined

classes

703,704, and705 may be associated to a license related to thecustomer715. The license is verified bylicense manager420.

In some embodiments,node controller160 is associated to anetwork operating center720 which obtains statistics data associated to the created user defined objects.Network operating center720 monitors and manages operation of a data network containingservicing node125. In other embodiments,node controller160, which can be a cloud service provider, is associated tobilling server725 which obtains accounting data associated to the created user defined objects.Billing server725 may generate a billing statement based on the obtained accounting data forcustomer715.

FIG. 8 illustrates an exemplary embodiment of user defined classes in an enterprise.Enterprise node controller805 represents a node controller for an IT department of an enterprise.Enterprise node controller805 provides user definedclass810, designed to offer company-wide services; user definedclass815, designed to offer departmental services; user definedclass820, designed to offer individual or group level services; and user definedclass825, designed specifically for sales department.Enterprise node controller805 monitors the IT services usingnetwork operating center720 and specially monitors security breaches and alerts usingnetwork security console830, which obtains security related statistics data from objectvirtual machine140.

The above description is illustrative and not restrictive. Many variations of the invention will become apparent to those of skill in the art upon review of this disclosure. The scope of the invention should, therefore, be determined not with reference to the above description, but instead should be determined with reference to the appended claims along with their full scope of equivalents. While the present invention has been described in connection with a series of embodiments, these descriptions are not intended to limit the scope of the invention to the particular forms set forth herein. It will be further understood that the methods of the invention are not necessarily limited to the discrete steps or the order of the steps described. To the contrary, the present descriptions are intended to cover such alternatives, modifications, and equivalents as may be included within the spirit and scope of the invention as defined by the appended claims and otherwise appreciated by one of ordinary skill in the art.

Claims

What is claimed is:

1. A system for configuring a network device with user-defined instruction scripts, the system comprising:

a servicing node including a network device, the servicing node comprising:

a plurality of user defined objects stored on the servicing node to configure the servicing node to execute the user-defined instruction scripts; and

an object virtual machine that executes instructions enabled by at least one of the plurality of user defined objects while the servicing node processes a network session of a network traffic between a client device and a server; and

at least one hardware node controller that sends a user defined class and a user defined object configuration to the servicing node, the user defined class and the user defined object configuration being defined by a user of the network, the user defined class including the user-defined instruction scripts, the user-defined instruction scripts including one or more instructions and a description for generating at least one user defined object, the user-defined instruction scripts being provided by the user of the network device, the user defined object configuration including at least one configuration provided by the user of the network device for the at least one user defined object, the at least one configuration including a plurality of attributes;

wherein the servicing node is configured to, upon receiving the user defined class and the user defined object configuration, instruct the object virtual machine to generate the at least one user defined object;

wherein the object virtual machine is configured to:

generate the at least one user defined object based on the description included in the user defined class and based on the plurality of attributes of the at least one configuration included in the user defined object configuration, wherein the at least one user defined object includes one or more parameters to enable the one or more instructions to be executed by the object virtual machine for processing one or more network sessions, wherein the at least one user defined object further includes object variables, the object variables including network parameters associated with processing of the network traffic;

store the at least one user defined object on the servicing node to configure the servicing node to execute the user-defined instruction scripts;

determine if the at least one user defined object is applicable to a data packet of the network session;

apply a security policy to the data packet of the network session;

match the data packet of a network application with a list of permissible network applications;

apply the at least one user defined object to the data packet of the network session to process the data packet by applying the one or more instructions comprised in the at least one user defined object and defined by the user of the network device, wherein the user defined object allows the user to configure the network device with the user-defined instruction scripts; and

based on the processing of the data packet, updating, by the object virtual machine, one or more of the object variables stored in the at least one user defined object.

2. The system ofclaim 1, wherein the servicing node further comprises the network application.

3. The system ofclaim 2, wherein the servicing node applies the at least one user defined object in conjunction with the network application to process the network session.

4. The system ofclaim 1, wherein the user defined class includes a template for one or more instruction to create the at least one user defined object.

5. The system ofclaim 1, wherein the servicing node applies the at least one user defined object after receiving the user defined object configuration and the user defined class, prior to the processing the network session.

6. The system ofclaim 1, wherein the servicing node applies the at least one user defined object after receiving the user defined object configuration and the user defined class, while the network session is in progress.

7. The system ofclaim 1, wherein each of the plurality of user defined objects is configured with a different IP address.

8. The system ofclaim 1, wherein the user defined class requires a license to create the at least one user defined object.

9. The system ofclaim 1, wherein the object virtual machine provides object variables of the at least one user defined object to the at least one hardware node controller.

10. The system ofclaim 9, wherein the object variables comprise accounting data and statistics data.

11. A method to configure a network device with user-defined instruction scripts, the method comprising:

receiving a request for a network session of a network traffic between a client device and a server;

receiving, by a servicing node, a user defined class and a user defined object configuration, the servicing node including the network device, the user defined class and the user defined object configuration being defined by a user of the network device, the user defined class including the user-defined instruction scripts, the user-defined instruction scripts including one or more instructions and a description for generating at least one user defined object, the user-defined instruction scripts being provided by the user of the network device, the user defined object configuration including at least one configuration provided by the user of the network device for the at least one user defined object, the at least one configuration including a plurality of attributes;

upon receiving the user defined class and the user defined object configuration, instructing, by the servicing node, an object virtual machine running on the servicing node to generate the at least one user defined object;

generating, by the object virtual machine, the at least one user defined object based on the description included in the user defined class and based on the plurality of attributes of the at least one configuration included in the user defined object configuration, wherein the at least one user defined object includes one or more parameters to enable the one or more instructions to be executed by the object virtual machine for processing one or more network sessions, wherein the at least one user defined object further includes object variables, the object variables including network parameters associated with processing of the network traffic;

storing the at least one user defined object on the servicing node to configure the servicing node to execute the user-defined instruction scripts;

determining if the at least one user defined object is applicable to a data packet of the network session;

applying a security policy to the data packet of the network session;

matching the data packet of a network application with a list of permissible network applications;

applying, by the object virtual machine, the at least one user defined object to the data packet of the network session to process the data packet by applying the one or more instructions comprised in the at least one user defined object and defined by the user of the network device, wherein the user defined object allows the user to configure the network device with the user-defined instruction scripts; and

12. The method ofclaim 11, wherein the user defined class requires a license to create the at least one user defined object.

13. The method ofclaim 11, wherein the object virtual machine provides object variables of the at least one user defined object to at least one hardware node controller.

14. The method ofclaim 13, wherein the object variables comprise accounting data and statistics data.

15. A system for configuring a network device with user-defined instruction scripts, the system comprising:

a servicing node including a network device, the servicing node comprising:

at least one hardware node controller that sends a user defined class and a user defined object configuration to the servicing node, the user defined class and the user defined object configuration being defined by a user of the network device, the user defined class including the user-defined instruction scripts, the user-defined instruction scripts including one or more instructions and a description for generating at least one user defined object, the user-defined instruction scripts being provided by the user of the network device, the user defined object configuration including at least one configuration provided by the user of the network device for the at least one user defined object, the at least one configuration including a plurality of attributes,

wherein the object virtual machine is configured to:

apply a security policy to the data packet of the network session;

apply the at least one user defined object to the data packet of the network session while the network session is in progress to process the data packet by applying the one or more instructions comprised in the at least one user defined object and defined by the user of the network device, wherein the user defined object allows the user to configure the network device with the user-defined instruction scripts; and

based on the processing the data packet, updating, by the object virtual machine, one or more of the object variables stored in the at least one user defined object.